CVE-2024-27804
Published: 14 May 2024
Summary
CVE-2024-27804 is a medium-severity Allocation of Resources Without Limits or Throttling (CWE-770) vulnerability in Apple Visionos. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 10.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-27804 is a memory-handling flaw affecting multiple Apple operating systems, including iOS and iPadOS prior to 17.5, macOS Sonoma prior to 14.5, tvOS prior to 17.5, visionOS prior to 1.3, and watchOS prior to 10.5. The vulnerability stems from insufficient controls on resource allocation and sequential memory operations, classified under CWE-770 and CWE-1325, and carries a CVSS 5.5 rating reflecting local attack vector, low complexity, and high availability impact without requiring elevated privileges.
An unprivileged local application can trigger the flaw after user interaction, leading to unexpected system termination and a denial-of-service condition on the affected device. No remote code execution or data compromise vectors are indicated in the available details.
Apple security advisories for the listed platform updates state that the issue was resolved through improved memory handling in the released versions, with installation of iOS 17.5, macOS Sonoma 14.5, and equivalent updates serving as the primary mitigation.
EPSS scores remained low throughout, reaching a modest peak of 0.0636 before receding to the current 0.0427, indicating limited post-disclosure exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-24997
Vulnerability details
The issue was addressed with improved memory handling. This issue is fixed in iOS 17.5 and iPadOS 17.5, macOS Sonoma 14.5, tvOS 17.5, visionOS 1.3, watchOS 10.5. An app may be able to cause unexpected system termination.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
This control implements explicit throttling on session allocation, addressing the weakness of allocating resources without limits.
Plan testing exercises resource allocation limits and throttling during simulated failures, directly addressing weaknesses that allow unbounded resource use.
Contingency plan updates ensure recovery strategies address unbounded resource allocation, making it harder for attackers to exploit lack of throttling to cause prolonged outages.
Provides continuity when unbounded resource allocation at the primary site leads to exhaustion and downtime.
Alternate services allow operations to continue when primary allocation of resources lacks limits or throttling.
Explicit planning of security-related actions requires defining limits, windows, and resource allocations, making allocation without throttling far less likely.
Measures of performance include tracking allocation behavior and throttling effectiveness, reducing the window for resource exhaustion attacks.
Imposes an inactivity-based limit on network resource allocation, throttling the number of concurrently held connections.